ClawHub
Back to skill

Security audit

Agent Paddleocr Vision

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward PaddleOCR cloud document-processing skill, with no hidden or destructive behavior found, but users should treat processed documents as third-party uploads.

Before installing or using this skill, confirm that you are allowed to upload the documents you process to the configured PaddleOCR cloud service, especially IDs, passports, bank records, tax forms, and contracts. Review the external repository scripts before running them because they are referenced but not included in this artifact.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill explicitly instructs users to send document images and PDFs to a cloud OCR API using credentials, but it does not clearly warn that potentially sensitive document contents will be transmitted to a third-party service. Because the supported document types include passports, ID cards, bank statements, tax forms, and contracts, users may unknowingly upload highly sensitive personal or financial data, creating privacy, compliance, and data handling risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.